Extended hostname validation

Last Updated : Nov 27, 2018 |
Prolog information
Metadata
Keywords:
Extended hostname validation provides an extra measure of certificate checking when establishing outgoing TLS connections with another server. When extended hostname validation is enabled, Presence Services validates the identity of the other server based on the certificate received during the negotiation process. Specifically, Presence Services validates the other server’s identity as specified in the Common Name (CN) field of the Subject Name or the Subject Alternative Name (SAN) against the IPs or FQDNs configured in the system prior to the TLS connection setup. If there is a mismatch between the value in the certificate received and the provisioned/expected value, the connection is dropped immediately.
Note:
Ideally, the Common Name field is only examined if-and-only-if the SAN field is not present.
Note:
For SAN (DNSname) fields, one level of wild-carding is acceptable. For example, an external server may have *.example.com configured in its certificate. This would match against servers configured as level1.example.com or www.example.com, but would not match level2.level1.example.com or example.com.
Related links
Enabling or disabling extended hostname validation